CVE-2025-31343: Siemens Telecontrol Server Basic SQLi

CVE-2025-31343 Overview

CVE-2025-31343 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions before V3.1.2.2. The flaw resides in the internally used UpdateTcmSettings method, which fails to properly sanitize input passed to backend database queries [CWE-89]. An authenticated remote attacker with access to TCP port 8000 can exploit this weakness to bypass authorization controls, read and modify database contents, and execute code under the NT AUTHORITY\NetworkService account. The vulnerability was reported through the Zero Day Initiative under identifier ZDI-CAN-25920.

Critical Impact
Authenticated attackers reaching port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and gain full read/write access to the TeleControl Server Basic database.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
Siemens industrial control deployments using TeleControl Server Basic for SCADA telecontrol
Windows hosts running the vulnerable TeleControl service exposing TCP port 8000

Discovery Timeline

2025-04-16 - CVE-2025-31343 published to NVD
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-31343

Vulnerability Analysis

The vulnerability exists in the UpdateTcmSettings method exposed by the TeleControl Server Basic application. The method accepts attacker-controlled input and concatenates it into a SQL statement without proper parameterization or input validation. This classic SQL injection flaw [CWE-89] allows manipulation of the query structure executed against the backend database.

Because the method is described as "internally used," authorization checks are weaker than on externally exposed endpoints. An authenticated attacker can invoke the method directly and bypass authorization controls that would otherwise restrict configuration changes. Once the injection point is reached, the attacker can read arbitrary tables, modify configuration records, and leverage database functionality to execute operating system commands.

Code execution occurs in the security context of the NT AUTHORITY\NetworkService account, which the TeleControl service uses on Windows hosts. This account has network access and sufficient privileges to interact with other services and persist on the host.

Root Cause

The root cause is the construction of SQL queries through string concatenation of untrusted input inside the UpdateTcmSettings handler. The application does not use prepared statements or enforce a strict input schema on the parameter values before passing them to the database driver.

Attack Vector

Exploitation requires network reachability to TCP port 8000 on the affected host and valid application credentials. The attacker submits a crafted request that invokes UpdateTcmSettings with malicious SQL fragments embedded in its parameters. The injected payload executes within the database engine, which can be chained to operating system command execution under NetworkService.

No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Siemens Security Advisory SSA-443402 for vendor technical details.

Detection Methods for CVE-2025-31343

Indicators of Compromise

Unexpected outbound network connections originating from the TeleControl Server Basic service process running as NT AUTHORITY\NetworkService
New or modified rows in TeleControl configuration tables outside of approved change windows
Database engine processes spawning command shells, cmd.exe, or powershell.exe child processes
Authentication events on TCP port 8000 from sources not in the operations allowlist

Detection Strategies

Inspect application and database logs for malformed parameters or SQL syntax errors associated with UpdateTcmSettings invocations
Alert on process lineage where the TeleControl service or its database backend launches script interpreters or system utilities
Baseline normal port 8000 client populations and flag deviations from operator workstations and engineering hosts

Monitoring Recommendations

Forward TeleControl Server Basic logs and Windows Security event channels to a centralized SIEM for correlation
Monitor file integrity on the TeleControl installation directory and database files for unauthorized modification
Track service account behavior for NetworkService activity that deviates from documented operational patterns

How to Mitigate CVE-2025-31343

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to version V3.1.2.2 or later as specified in advisory SSA-443402
Restrict access to TCP port 8000 to a minimal set of trusted engineering and operations hosts using host and network firewalls
Rotate credentials for all TeleControl application accounts and review authorization assignments
Audit the TeleControl database for unauthorized changes introduced before patching

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates the SQL injection in the UpdateTcmSettings method. Patch details and download instructions are available in the Siemens Security Advisory SSA-443402.

Workarounds

Place the TeleControl Server Basic host inside a segmented OT network and block port 8000 from general corporate and internet access
Enforce VPN or jump host access for any administrative interaction with the application
Disable or remove TeleControl application accounts that are no longer required to shrink the authenticated attack surface

bash

# Example Windows firewall rule restricting TCP 8000 to a trusted management subnet
netsh advfirewall firewall add rule name="TeleControl-8000-Restrict" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.20.30.0/24

netsh advfirewall firewall add rule name="TeleControl-8000-Block" ^
  dir=in action=block protocol=TCP localport=8000